Ransomware Detection via Hierarchical Storage File Statistics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions fail to detect ransomware attacks in a timely manner, leading to file system encryption and requiring full system restore from backups, which is time-consuming and may result in data loss if no backup is available, forcing users to pay ransomware attackers.
Innovation Solution
A ransomware detection and management system that includes a hierarchical storage management solution, collecting file statistics, identifying affected files, locking down access, undoing reconcile processing, and automatically repairing encrypted files by moving them to a quarantine folder and restoring previous versions from a backup server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current ransomware detection solutions are used, then detection occurs after file system encryption, but this results in significant data loss and requires full system restore
Solution Approach 1:
The system performs preliminary actions by collecting file statistics and creating baselines before ransomware encryption occurs. It continuously monitors file access patterns, deduplication rates, and compression ratios during normal operation, enabling early detection when anomalies appear without waiting for full encryption to manifest
Solution Approach 2:
The system implements feedback mechanisms by continuously comparing current file statistics against established baselines. When deviations exceed thresholds (such as abnormal deduplication rates or compression ratios), the system triggers alerts and automated responses, creating a closed-loop detection and response system
2Reliability
If full system restore from backup is performed to repair encrypted files, then file system can be recovered, but this causes significant downtime and operational disruption
Solution Approach 1:
The system segments the recovery process by identifying and isolating only the specific files affected by ransomware rather than restoring the entire file system. It uses file-level anomaly detection to pinpoint encrypted files and applies targeted repair operations, minimizing disruption to unaffected portions of the file system
Solution Approach 2:
The system discards the need for full system restore by maintaining and utilizing existing file versions through its continuous statistics collection and baseline comparison. When ransomware is detected, it recovers only the necessary affected files by reverting them to their pre-encryption state based on previously collected data, rather than performing a complete system restore
3Reliability
If no backup is available or encrypted files have been backed up, then full restore is impossible, but this results in permanent data loss or forced ransom payment
Solution Approach 1:
The system performs preliminary data protection by continuously collecting file statistics, access patterns, and content characteristics before ransomware encryption occurs. This creates a historical record of file states that can be used for recovery even when traditional backups are unavailable or have already been encrypted
Solution Approach 2:
The system creates implicit copies of file information through its continuous statistics collection process. By monitoring and recording file metadata, access patterns, and content characteristics, it maintains redundant information about files that can be used to reconstruct or recover files without requiring separate backup copies
4Loss of time
If file statistics collection and analysis is implemented for early detection, then near real-time ransomware identification is possible, but this increases system complexity and processing overhead
Solution Approach 1:
The system achieves multi-functionality by using a single statistics collection infrastructure that serves both hierarchical storage management operations and ransomware detection purposes. The same file access monitoring, deduplication tracking, and compression ratio calculation used for storage optimization also provide the data needed for anomaly detection, eliminating the need for separate dedicated detection hardware or software
Data Source
AI summary
A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.